Passpoint Connects and Authenticates, But No Internet Access

What's happening

A device successfully authenticates to a Passpoint (Hotspot 2.0) network — meaning it's recognized and accepted onto the network — but never actually gets online. This is different from a device that can't connect at all; here, the device appears connected but has no working internet or call functionality.

Root cause

If a device authenticates but gets a self-assigned 169.254.x.x address, it means the device never received a valid IP from DHCP. There are two common causes for this — check them in order:

Cause 1: Missing DHCP helper configuration on the wireless controller

After a device authenticates, it needs to be issued a valid IP address by DHCP. If the controller isn't properly forwarding DHCP requests to the correct server — often because a required "helper" setting is missing — the device ends up with a self-assigned, non-functional address instead of a real one.

Cause 2: Missing VLAN tag on the switch trunk port

Even if the wireless controller and SSID are configured correctly, DHCP traffic can still be blocked further down the path — specifically, if the VLAN used for Passpoint traffic isn't tagged on the switch trunk port(s) connecting your access points. In this case, the SSID and VLAN template may show everything configured correctly, but DHCP requests never actually reach the DHCP server because the switch port doesn't know to pass that VLAN's traffic. This is especially worth checking if the network was previously working and recently stopped — a VLAN tag being removed from a trunk port during other network changes is a common cause.

Troubleshooting steps (for your network/IT team)

1. Check the device's assigned IP address. If it's in the 169.254.x.x range, this confirms the device authenticated but never received a valid DHCP-assigned address — pointing to a DHCP delivery issue rather than an authentication problem.
2. Review your wireless controller's DHCP relay/helper configuration for the policy or profile associated with the Passpoint SSID. Confirm a DHCP helper address is configured and points to the correct DHCP server for that VLAN.
3. If the helper configuration looks correct, check the switch side next. Confirm the VLAN used for Passpoint traffic is tagged (allowed) on the trunk port(s) connecting your access points to the switch. A missing VLAN tag here will block DHCP traffic even when everything upstream is configured properly.
4. If the network was previously working and recently broke, check whether a recent switch configuration change may have removed the VLAN tag from the trunk port.
5. Add or correct whichever setting is missing (DHCP helper or VLAN trunk tag), then have the device reconnect.
6. Confirm the device receives a valid IP address (not a 169.254.x.x address) after reconnecting.

Either fix typically takes effect immediately — no reboot or extended wait is usually needed.

Also check: does the device have the correct carrier profile?

Some devices — particularly those originally provisioned under a different carrier or sub-brand than the network they're roaming on — may not have the correct Passpoint profile installed, even if their plan supports Wi-Fi Calling. This can show up as the device prompting for a username/password instead of joining automatically, rather than the "connected but no internet" symptom above.

If this happens: install our companion app to push the correct Passpoint profile to the device, then retry.

If the issue continues

If you've checked both the DHCP helper configuration and the switch trunk port VLAN tagging and the device still isn't getting a valid IP address, contact support with:

• The device type and what IP address it's receiving
• Confirmation of what you found when checking the DHCP helper configuration and the switch trunk port VLAN tagging

Our team can work with your network admin to review the controller and switch configuration in more detail.

Book a call: Contact American Bandwidth